North Carolina

North Carolina has not enacted a general-purpose AI-transparency, output-labeling, or risk-management statute; the state's only enacted AI-specific instrument criminalizes conduct rather than requiring disclosure.

Session Law 2024-37 (House Bill 591) amended North Carolina's disclosure-of-private-images and sexual-exploitation-of-a-minor statutes so that a realistic image created, adapted, or modified using artificial intelligence is treated the same as a real photograph, reaching AI-generated nonconsensual intimate images and AI-generated child sexual abuse material as criminal offenses binding any person.

Governor Stein's Executive Order No. 24 (September 2, 2025) establishes a state AI Leadership Council and an AI Accelerator and directs state agencies on their own use of artificial intelligence, but by its own terms imposes no obligations on private entities, so it is recorded here as context rather than as an instrument.

Four AI-specific bills remained in committee as of the date shown, none having passed either chamber: House Bill 1161 (omnibus AI protections), House Bill 375 (AI and synthetic media disclosure), and companion Senate Bills 624 and 963 (AI chatbot licensing and safety).

North Carolina has no comprehensive consumer personal-data-protection statute. The marquee candidate, House Bill 462 (the NC Personal Data Privacy Act), remains in House committee with no floor vote in either chamber. North Carolina's operative privacy statute is the Identity Theft Protection Act's breach notification duty, N.C. Gen. Stat. Secs. 75-61 and 75-65 (Chapter 75, Article 2A), which sets no numeric notification deadline, requiring only notice without unreasonable delay.

The Act's personal information definition incorporates identifying information by cross-reference to North Carolina's criminal identity-theft statute, G.S. Sec. 14-113.20(b), which lists biometric data as one of fourteen enumerated items, but no North Carolina statute anywhere defines what the term means; it is used but never defined, so whether it excludes or reaches an identifier derived from a recording cannot be determined either way.

A 2025 amendment, Session Law 2025-25, confirmed that a breach-notice violation is a violation of North Carolina's general Unfair and Deceptive Trade Practices Act, arming an individual injured by the violation with a private civil action for treble damages under G.S. Sec. 75-16, though the injury requirement is written into the deeming clause itself.

North Carolina's divergence from the federal baseline runs through its computer-related crime statute, Article 60 of Chapter 14, which defines authorization by reference to the computer owner's actual consent and separately criminalizes making an unauthorized copy of computer data as computer trespass, backed by a private civil action for damages including lost profits. Copyright, text-and-data-mining, and database rights are federal only; North Carolina adds nothing there.

Terms-of-service enforceability rests on ordinary North Carolina contract law, and robots.txt carries no independent legal weight in North Carolina.

North Carolina's product-security and cyber-resilience posture, for a private-sector operator, rests on one enacted state statute with a narrow scope: the Identity Theft Protection Act's destruction-of-records duty, N.C. Gen. Stat. section 75-64 (Chapter 75, Article 2A, added by S.L. 2005-414, s. 1, effective December 1, 2005), which requires any business that conducts business in North Carolina, or that maintains or otherwise possesses the personal information of a North Carolina resident, to take reasonable measures, described in the statute as burning, pulverizing, or shredding paper records and destroying or erasing electronic and other nonpaper media, to protect against unauthorized access to or use of personal information in connection with or after its disposal.

The duty reaches only the disposal phase; it does not extend, the way New York's SHIELD Act safeguards duty or Massachusetts's 201 CMR 17.00 do, to a general written information-security-program requirement for personal information while it remains in active use, and no such general requirement was located in North Carolina law. No enacted North Carolina statute was located that sets security requirements a connected device or software product must meet before or after it reaches the market.

North Carolina has no general private-sector duty to report an exploited vulnerability or a security incident to an authority: the state's Ransomware Act, N.C. Gen. Stat. section 143-800 (Chapter 143, Article 84, added by S.L. 2021-180, s. 38.13(a)), bars a state agency or local government entity from paying or communicating with a ransomware attacker and requires either to consult the Department of Information Technology on a ransom request, but both bound terms are defined to reach only government bodies, so this belongs with the jurisdiction's government-accountability material rather than as a row in this profile's private-sector scope.

The state's one sector-specific security regime, N.C. Gen. Stat. sections 58-39-130 to 58-39-165 (Chapter 58, Article 39, Part 3, "Customer Information Safeguards," added by S.L. 2003-262, s. 4, effective April 1, 2005), implements the federal Gramm-Leach-Bliley Act's safeguards requirements for the insurance sector, requiring each "licensee," an insurance producer, insurer, multiple employer welfare arrangement, HMO, or Chapter 58 service corporation, to implement a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to its size and complexity and the nature and scope of its activities.

North Carolina has not separately adopted the newer NAIC Insurance Data Security Model Law: a full-text search of Chapter 58's own section index for "cybersecurity" and "data security" returned nothing outside this 2003 Gramm-Leach-Bliley Act (GLBA)-based Part. Because "licensee" is a role the LexLint activity vocabulary cannot yet express, no instrument for this duty is filed here (#6740), and it is recorded in this summary so a reader knows it exists.

G.S. 75-64 is enforced as a deemed violation of the state's general unfair-or-deceptive-trade-practices statute, G.S. 75-1.1: a person injured by a violation may bring a civil action under G.S. 75-16 for treble the damages found, with treble damages for a nonmanagerial employee's own acts or omissions available only where the business was negligent in training, supervising, or monitoring that employee, and the Attorney General may separately sue to enjoin a violation.

No capped or per-violation civil-penalty figure is recorded for this instrument because the statutory remedy is trebled actual damages rather than a stated amount, and no published enforcement record specific to this duty was located.

North Carolina's breach-notification duty, the Identity Theft Protection Act's G.S. 75-65, is already this jurisdiction's privacy row rather than repeated here, and a narrower, adjacent duty at G.S. 75-62(c), requiring a business handling social security numbers to make reasonable efforts, including systems testing, to ensure that Article's SSN-protection requirements are implemented, also stays with that privacy row rather than being filed separately here.

North Carolina has two in-effect adult content laws. The PAVE Act, enacted in 2023, requires websites with substantial harmful-to-minors content to age-verify visitors and is enforced only through private civil suits. House Bill 805, enacted over the Governor's veto in July 2025, requires pornography platforms to verify the age and written consent of every individual depicted and honor removal requests, effective December 1, 2025.

A separate social media minor-access bill, House Bill 301, passed the House in 2025 and the Senate in 2026 in different forms and went to a House-Senate conference committee in late June 2026. No app store or design code law has been enacted or advanced past a single chamber.